f3nris
815db080f5
The generic mapper now fills the OCSF fields a relayed message has a place for: metadata.logged_time, log_provider and log_name, the checks the delivery passed as metadata.labels (relay:hmac…), and raw_data. The sender's address goes to unmapped.relay.sender_ip rather than src_endpoint.ip: it is the vendor's cloud, and as an entity it would correlate every alert of that vendor. metadata.product.name no longer holds the source id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xa1QDbsPTYiVREv2Cvs3Zn
61 lines
3.8 KiB
YAML
61 lines
3.8 KiB
YAML
id: webhook_relay
|
|
name: Webhook Relay
|
|
version: 1.0.1
|
|
description: "Reads the alerts that vendors pushed to riposte-relay, the public mailbox for alert webhooks (riposte/relay/). Riposte accepts no inbound connection, so a source whose only output is a webhook — Rapid7 InsightIDR Essential basic detection rules, for one — posts to the relay, and an alert rule on this integration reads one relay source back over outbound HTTPS. The relay knows no vendor: the rule chooses the client, the alert type and the mapper. A read consumes nothing; the rule's watermark is the read's `since`, so after a failover the standby reads the same mailbox from its own watermark."
|
|
changelog: "1.0.1 — The generic mapper fills the OCSF fields that have a place for a relayed message: metadata.logged_time (receipt), metadata.log_provider and log_name (relay, source), metadata.labels (the checks passed, relay:hmac…), raw_data (the payload). The sender address goes to unmapped.relay.sender_ip, not src_endpoint.ip: it is the vendor's cloud, and as an entity it would tie every alert of that vendor together. metadata.product.name no longer holds the source id. | 1.0.0 — Initial release: fetch_messages (ingestion: one alert per relayed message, `since` watermark, page walk), relay_status, test_connection, and a generic mapper that keeps the raw body and the checks the message passed."
|
|
category: ingestion
|
|
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "The relay's public address, e.g. https://hermod.acknowledge.tools"
|
|
read_token:
|
|
type: string
|
|
description: "The relay's consumer token. The relay holds only its SHA-256 (RELAY_CONSUMER_TOKEN_SHA256); this Riposte must also call from an address in RELAY_CONSUMER_ALLOW_IPS."
|
|
x-soar-sensitive: true
|
|
required:
|
|
- base_url
|
|
- read_token
|
|
|
|
commands:
|
|
- id: fetch_messages
|
|
name: webhook-relay-fetch-messages
|
|
description: "Messages a relay source received since a watermark, oldest first, every page followed. Ingestion: results path = messages, one alert per message, dedup on the relay's message id. Each message carries source, received_at, remote_ip, headers, verified (the checks it passed: path_token, header_token, hmac, ip), body (or body_b64) and json when the body parses. Reading consumes nothing."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
source:
|
|
type: string
|
|
description: "Relay source id, e.g. r7-acme — the mailbox to read. The client this alert rule is bound to must be the one this source was made for."
|
|
since:
|
|
type: string
|
|
description: "Lower bound on received_at: ISO-8601, UNIX seconds or milliseconds. Incremental fetch watermark."
|
|
limit:
|
|
type: number
|
|
description: "Most messages one run may gather (default 10000, the relay's own per-source cap). A window holding more fails the run rather than dropping the rest: the watermark stays put and the next run reads it again."
|
|
required: [source]
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: messages
|
|
dedup_key: id
|
|
incremental_field: since
|
|
|
|
- id: relay_status
|
|
name: webhook-relay-status
|
|
description: "Per relay source: messages waiting, oldest and newest, accepted and rejected counts by reason (ip, path_token, header_token, hmac, size, rate, full…), last accepted, last read. Counters restart with the relay. A rising rejected count on a source is a misconfigured vendor — or someone trying."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: webhook-relay-test-connection
|
|
description: "Verify the relay answers this Riposte and the read token (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|